Trigona Ransomware Uses Custom Tool to Exfiltrate Data
Summary
Symantec reports that recent Trigona attacks used uploader_client.exe to exfiltrate data with parallel uploads and TCP rotation, alongside kernel-driver abuse, privilege escalation, remote access and credential theft.
Key points
- Symantec observed Trigona operators using the custom command-line tool uploader_client.exe to steal data from compromised environments.
- The tool supports five simultaneous connections per file, rotates TCP connections after 2GB, and can exclude selected file types.
- In one incident, it was used to steal documents, including invoices and PDFs, from network drives.
- The attackers used HRSword as a kernel driver and vulnerable drivers to terminate endpoint-protection processes.
- The reported activity also involved PowerRun for elevated execution, AnyDesk for remote access, and Mimikatz and Nirsoft utilities for credential theft or password recovery.
- Symantec published indicators of compromise to help detect and block the latest Trigona activity.
Article Details
- Event Type
- Reported resumption of Trigona ransomware activity using a custom data-exfiltration tool
- Impact
- Symantec reports that attackers used uploader_client.exe to steal documents from compromised environments, disabled endpoint protection using vulnerable kernel drivers, and used remote-access and credential-theft utilities. The source does not quantify the number of victims or the amount of data stolen.
MITRE ATT&CK
Threat Actors
Malware
Products
AnyDeskThey used PowerRun for elevated execution, AnyDesk for remote access, and utilities like Mimikatz and Nirsoft for credential theft.Huorong Network Security SuiteAccording to Symantec’s observations of recent Trigona attacks, threat actor installs the Huorong Network Security Suite tool HRSword as a kernel driver service.PowerRunThey used PowerRun for elevated execution, AnyDesk for remote access, and utilities like Mimikatz and Nirsoft for credential theft.
Tools
DumpGuardThis phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd).GMERThis phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd).HRSwordAttackers installed HRSword as a kernel driver and leveraged vulnerable drivers to terminate endpoint protection.MimikatzThey used PowerRun for elevated execution, AnyDesk for remote access, and utilities like Mimikatz and Nirsoft for credential theft.NirSoftThey used PowerRun for elevated execution, AnyDesk for remote access, and utilities like Mimikatz and Nirsoft for credential theft.PCHunterThis phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd).StpProcessMonitorByovdThis phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd).uploader_client.exeResearchers observed Trigona ransomware operators using a custom command-line exfiltration tool named uploader_client.exe to steal data faster and evade detection.WKToolsThis phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd).YDarkThis phase is followed by deploying additional tools that can disable security-related products (e.g., PCHunter, Gmer, YDark, WKTools, DumpGuard, and StpProcessMonitorByovd).